# bunqueue v2.6.60

Fixes 2 bugs. Webhook SSRF prevention in embedded mode: WebhookManager.add() now validates URLs against SSRF (localhost, private IPs, cloud metadata).

Canonical: https://bunqueue.dev/blog/bunqueue-v2-6-60/

---

<!-- Generated from changelog.md by docs/scripts/generate-release-posts.ts. Edit the changelog and regenerate. -->

Fixes 2 bugs. Webhook SSRF prevention in embedded mode: WebhookManager.add() now validates URLs against SSRF (localhost, private IPs, cloud metadata).

#### To install bunqueue v2.6.60

```bash title="bun"
bun add bunqueue@2.6.60
```

```bash title="npm"
npm install bunqueue@2.6.60
```

#### To upgrade bunqueue

```bash
bun add bunqueue@latest
```

## Changes

- **Extracted `validateWebhookUrl` to shared module**: `src/shared/webhookValidation.ts` is now the single source of truth, re-exported from `protocol.ts` for backward compatibility.

## Bugfixes

- **Webhook SSRF prevention in embedded mode**: `WebhookManager.add()` now validates URLs against SSRF (localhost, private IPs, cloud metadata). Previously only enforced at TCP server layer, leaving embedded SDK unprotected.
- **Docs: pin Zod v3 for Starlight**: Fixed Vercel build crash caused by Zod v4 incompatibility with Starlight 0.31.

---

[← bunqueue v2.6.49](https://bunqueue.dev/blog/bunqueue-v2-6-49/) · [Full changelog](https://bunqueue.dev/changelog/) · [All posts](https://bunqueue.dev/blog/)